SUSE CVE-2024-56616

In the Linux kernel, the following vulnerability has been resolved: drm/dpmst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC aka message data CRC at the end of the message. This fixes a...

CVE-2024-56616

CVE-2024-56616 (Linux kernel) affects drm_dp_mst sideband handling. The MST sideband message body length check was fixed to require at least 1 byte (accounting for the message CRC). Without this, a header with a valid header CRC but body length 0 could trigger memory corruption in drm_dp_sideband...

The vulnerability of the message_body() function in the program/actions/mail/show.php file of the RoundCube Webmail email client allows a hacker to gain full access to the user’s email by sending a specially crafted message.

The vulnerability of the messagebody function in the program/actions/mail/show.php file of the RoundCube Webmail email client exists due to the lack of security measures for handling web page structures. Exploiting this vulnerability allows an attacker to gain full access to the email account by...

UBUNTU-CVE-2024-42009

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php...

SUSE CVE-2012-4600

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags...

Apple SwiftNIO Extras 安全漏洞

Apple SwiftNIO Extras is an extension for the SwiftNIO web application framework from Apple Inc. A security vulnerability exists in Apple SwiftNIO Extras, which stems from the fact that if garbage data is appended to the body of an HTTP message, the code will repeatedly attempt to decompress this...

GHSA-GJ9C-69CM-7C37 Alkacon OpenCms XSS via unsanitized message body

Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script or HTML via the message body...

HTTP Request Smuggling

mitmproxy is vulnerable to HTTP request smuggling. The vulnerability exists because the header names contain whitespace characters by default, allowing an attacker to smuggle HTTP requests or responses by submitting a malicious message body...

Spring-AMQP Remote Denial of Service - Out of Memory Error with a Large Message Body

The Spring AMQP Message object, in its toString method, will create a new String object from the message body, regardless of its size. This can cause an OOM Error with a large message body...

Code Injection

Mozilla Thunderbird is vulnerable to remote code execution vulnerability. RSS fields can inject new lines into the created email structure, modifying the message body...

CVE-2018-18621

CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer, which is mishandled in /MIME/INBOX-MM-1/ if the raw email link in .txt format is modified and then renamed with a .html or .wssp extension...

CVE-2018-13000

An XSS issue was discovered in Advanced Electron Forum AEF v1.0.9. A persistent XSS vulnerability is located in the FTP Link element of the Private Message module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to injec...

CVE-2017-7848

RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird 52.5.2...

CVE-2017-17752

Ability Mail Server 3.3.2 has Cross Site Scripting XSS via the body of an e-mail message, with JavaScript code executed on the Read Mail screen aka the /readmail URI. This is fixed in version 4.2.4...

CVE-2017-14077

HTML Injection in Securimage 3.6.4 and earlier allows remote attackers to inject arbitrary HTML into an e-mail message body via the $SERVER'HTTPUSERAGENT' parameter to exampleform.ajax.php or exampleform.php...

GNU oSIP libosip2 buffer overflow vulnerability (CNVD-2017-07203)

GNU oSIP is a library developed by the GNU Project to provide developers with an interface to multimedia and communications. libosip2 is a standard library for multithreading safety written in C. It is a library for the development of multimedia and communication applications. A buffer overflow...

Roundcube mail body of the stored cross site Vulnerability(CVE-2017-6820)

Author: Badcode, sebao know Chong Yu 404 security lab Date: 2017-03-17 0x00 vulnerability overview 1. Vulnerability description Roundcube is a widely used open source e-mail program, in the globe there are many organizations and companies are in use. On the server to successfully install...

Fing v3.3.0 iOS - Persistent Mail Encoding Vulnerability

Document Title: =============== Fing v3.3.0 iOS - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1772 Release Date: ============= 2016-02-28 Vulnerability Laboratory ID VL-ID: ====================================...

Merak Mail Server 7.4.5 HTML Message Body XSS

漏洞描述： Merak Webmail Server 5.2.7版本中存在多个跨站脚本XSS漏洞。远程攻击者可以通过category， cserver， ext， global，showgroups， address.html中的showlite参数，或者spage 或者 settings.html中的autoresponder参数，readmail.html中的folder参数，或者 attachment.html中的attachmentpagetexterror参数 folder， ct， 或者 calendar.html中的 cv 参数， 标签，...

CVE-2014-1877

Multiple cross-site scripting XSS vulnerabilities in Dokeos 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the 1 Phone, 2 Street, 3 Address line, 4 Zip code, or 5 City field to main/auth/profile.php; 6 Subject field to main/social/groups.php; or 7 Message body field to...